diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2014-11-05 18:24:00 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2014-11-05 19:02:19 +0000 |
| commit | 09c17790eec23907b93df1ec7cee746b28dfc836 (patch) | |
| tree | 388ffc0b4f7a1bb72521d58f0c128ef78e08ff5f /src | |
| parent | f6da88972f6404c77bc873873de5f298399cce5b (diff) | |
| parent | 8d69247061599b35b60308ca4b75ba529b8dcba2 (diff) | |
Do not permit multi-component wildcards on certificate names (OpenSSL, EXPERIMENTAL_CERTNAMES)
Diffstat (limited to 'src')
| -rw-r--r-- | src/src/tls-openssl.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index fe1b208ac..63bf83b1d 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -370,6 +370,9 @@ else # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0 # endif +# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS +# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0 +# endif { int sep = 0; uschar * list = verify_cert_hostnames; @@ -377,7 +380,8 @@ else int rc; while ((name = string_nextinlist(&list, &sep, NULL, 0))) if ((rc = X509_check_host(cert, name, 0, - X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS))) + X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS + | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS))) { if (rc < 0) { |